[Dnfbb-developers] Validating posts/topics/forums/categories

[Si C. <sim...@te...>]

Its just occurred to me that there could be a potential issue when
validating posts, topics, forums and categories.  I thought I'd share it
here to see if its just my thinking :-)

At the moment any validation is done by verifying the existence of the ID,
this could potentially open up a hole where a user on board 1, who has the
rights to delete a topic, can delete a topic on board 2.  This occurs
because only the existence of the id is verified.  What I think we need, and
this is where I need some verification as I don't want to add too much
overhead, is a series of functions which will take the id in question, along
with the user id and verify that this user has access to the specified ID
for posts, topics, forums and categories.  I have picked on the user id as
this is returned for all external functions, those that begin DNF_, when a
call to DNF_CHECK_TASK_PERMISSIONS is made.

Any thoughts welcome.

Rgds

Si